Threat Intelligence Roundup Covers Phishing Campaigns, Ransomware and Exploited Vulnerabilities
Summary
DarkOwl’s roundup highlights reports on phishing and malware campaigns, a ransomware breach at the University of Hawaii Cancer Center, a disputed Resecurity breach claim, and attacks exploiting a Sitecore zero-day.
Key points
- Apex Legends players reported attackers remotely controlling characters, disconnecting users, and changing nicknames; Respawn confirmed the incident.
- A phishing operation used 27 malicious npm packages to host browser-based lures targeting 25 organizations.
- Separate campaigns used LinkedIn messages and tax-themed emails to deliver remote access trojans, including ValleyRAT.
- The University of Hawaii Cancer Center reported a ransomware breach that encrypted research files and exposed participant data, including Social Security numbers.
- North Korea-linked actors reportedly used malicious VS Code projects to deploy backdoors, while Scattered Lapsus$ Hunters' claim of breaching Resecurity was disputed by the firm.
- China-linked actors reportedly exploited a Sitecore zero-day, CVE-2025-53690, in attacks against North American infrastructure.
Article Details
- Event Type
- A roundup of cybersecurity incidents and threat research covering game account control, phishing and malware campaigns, ransomware, alleged breaches, and exploitation of a Sitecore zero-day.
- Impact
- Reported impacts include disruption of Apex Legends matches; credential theft targeting organizations; attempted remote access through RAT malware; ransomware theft and encryption of University of Hawaii Cancer Center research data, including documents containing Social Security numbers; backdoor deployment on compromised developer systems; disputed claims of a Resecurity breach involving honeypot data; and attempts to compromise North American infrastructure through a Sitecore zero-day. The roundup reports no effect on University of Hawaii Cancer Center clinical operations or patient care.
CVE
Threat Actors
Contagious InterviewCampaign linked in the article to North Korean threat actors; not presented as a specifically named actor group.Scattered LAPSUS$ HuntersClaimed to have breached Resecurity and stolen internal data; Resecurity disputed the claim, saying the observed activity involved a monitored honeypot account containing fake information.Silver FoxIdentified as a Chinese threat actor distributing ValleyRAT through tax-themed phishing emails.UAT-8837China-linked threat actor reported attempting to compromise North American infrastructure, including by exploiting a Sitecore zero-day.
Malware
BeaverTailrun every time a file in the folder is opened, which eventually leads to deployment of malwares like, BeaverTail and InvisibleFerret.InvisibleFerretfile in the folder is opened, which eventually leads to deployment of malwares like, BeaverTail and InvisibleFerret.ValleyRAT4. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware – The Hacker News
Vendors
ReliaQuestReliaQuest’s Threat Research team has discovered a new phishing campaign using private messages to deliver malicious payloads with the intent to deploy remote access trojan (RAT).Resecurity7. Hackers claim to hack Resecurity, firm says it was a honeypot – BleepingComputerRespawnRespawn, the publisher of the game, confirmed the security incident claiming “bad actor is able to control the inputs of another player remotely in Apex Legends”.SocketOn December 23, 2025 the Socket Threat Research Team announced the discovery of a 5 month long spear-phishing operation that turned 27 npm packages “into durable hosting for browser-run lures that mimic document-sharing
Products
Apex Legends1. ‘Bad actor’ hijacks Apex Legends characters in live matches – BleepingComputerLinkedIn3. Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading – The Hacker NewsMicrosoft Visual Studio CodeThe Contagious Interview campaign, which has been linked to North Korean threat actors, has been observed leveraging a version of Microsoft Visual Studio Code (VS Code) to deploy a backdoor on compromised systems.npm2. 27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials – The Hacker NewsSitecore8. China-linked hackers exploited Sitecore zero-day for initial access – BleepingComputerWinRARThe attack began with a message sent via LinkedIn that contained a “malicious WinRAR self-extracting archive”.
Countries
China8. China-linked hackers exploited Sitecore zero-day for initial access – BleepingComputerIndiaThe group has focused on Indian entities, using phishing emails containing decoy PDFs claiming to be from India’s Income Tax Department.North Korea6. North Korea-Linked Hackers Target Developers via Malicious VS Code Projects – The Hacker News
Industries
Healthcareand Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare.Industrial automationand Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare.Manufacturingand Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare.Plasticsand Allied nations focusing on manufacturing, industrial automation, plastics, and healthcare.